After adding a new domain to HES, you cannot change the Virus and Spam or Phish policy in HES while the domain is in the process of being added. The status of the two rules is grayed out. However, you will still be able to modify the other policies and add new ones.
Under the Status column, it shows “Adding” if the mx record is still not redirected to HES.
You experience the error because ownership for the domain has not been confirmed yet. You need to add the HES MX record to your domain's MX record first.
To redirect the mx records to HES, refer to the KB article: Redirecting Mail Exchange (MX) records to Hosted Email Security (HES).
Once the HES MX record has been added, you should be able to modify the two rules.